Path Traversal Vulnerability in modelscope/agentscope Application

CVE-2024-8537

What is CVE-2024-8537?

A path traversal vulnerability exists within the modelscope/agentscope application, affecting all versions. This security flaw is found in the /delete-workflow endpoint, where inadequate input validation allows attackers to manipulate file paths. By exploiting this vulnerability, an attacker may gain the ability to delete arbitrary files from the filesystem, including sensitive data stored outside of the authorized directory. Proper sanitation of user inputs is crucial to mitigate the risks associated with this security issue.

References